CVE-2024-24911: Checkpoint Gaia OS DoS Vulnerability

CVE-2024-24911 Overview

CVE-2024-24911 affects Check Point Security Management Server and Domain Management Server deployments running Gaia OS. The cpca process, which handles Certificate Authority operations, may exit unexpectedly and generate a core dump file under rare conditions. When cpca is unavailable, VPN and Secure Internal Communication (SIC) connectivity can fail if the Certificate Revocation List (CRL) is not present in the Security Gateway's CRL cache. The flaw is tracked under [CWE-125] (Out-of-bounds Read) and is exploitable remotely without authentication or user interaction.

Critical Impact
Crash of the cpca Certificate Authority process disrupts VPN and SIC connectivity, breaking secure communication between gateways and the management server.

Affected Products

Check Point Gaia OS (R81, R81.10, R81.20, R82)
Check Point Multi-Domain Management
Check Point Quantum Security Management

Discovery Timeline

2025-02-06 - CVE-2024-24911 published to the National Vulnerability Database
2025-10-15 - Last updated in NVD database

Technical Details for CVE-2024-24911

Vulnerability Analysis

The vulnerability resides in the cpca daemon, the Check Point Internal Certificate Authority process running on the Security Management Server and Domain Management Server. Under specific input conditions, the process performs an out-of-bounds read that triggers an unexpected exit and writes a core dump to disk.

When cpca is offline, the management server cannot serve CRLs to Security Gateways. Gateways without a cached CRL reject certificate validation during Internet Key Exchange (IKE) and SIC handshakes. The result is loss of VPN tunnels and management plane connectivity until cpca is restarted or the CRL cache is repopulated.

The attack vector is network-based and requires no privileges or user interaction. Confidentiality and integrity are not impacted, but availability is high.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in the cpca process input handling. Malformed or unexpected data causes the process to read beyond an allocated buffer, leading to abnormal termination rather than memory disclosure.

Attack Vector

A remote unauthenticated attacker reachable to the management server's certificate authority service can submit crafted input that triggers the crash. Repeated triggering produces a denial-of-service condition against VPN and SIC operations. Check Point describes the trigger condition as rare, and no public exploit is available.

No verified proof-of-concept code is published for this issue. Refer to the Check Point Security Advisory sk183101 for technical details.

Detection Methods for CVE-2024-24911

Indicators of Compromise

Presence of cpca core dump files in /var/log/dump/usermode/ or the configured core dump directory on the Security Management Server.
Unexpected cpca process exits in /var/log/messages or cpca.elg log entries indicating abnormal termination.
VPN tunnel failures and SIC trust errors on Security Gateways that lack a cached CRL.

Detection Strategies

Monitor process state for cpca on management servers and alert on unexpected exits or restarts.
Audit core dump directories for new files matching core.cpca.* and treat their creation as a high-priority event.
Correlate cpca termination events with downstream IKE and SIC failures across managed gateways.

Monitoring Recommendations

Forward Check Point management logs and process telemetry to a centralized SIEM for continuous analysis.
Track cpca uptime as a service-level metric and trigger alerts on availability drops.
Review network traffic to the management server's CA service ports for anomalous or malformed sessions preceding crashes.

How to Mitigate CVE-2024-24911

Immediate Actions Required

Apply the hotfix described in Check Point sk183101 to all affected Security Management and Domain Management Servers.
Restrict network access to the management server's certificate authority service to trusted administrative networks and managed gateways only.
Restart cpca if a crash is detected and verify CRL distribution to all gateways.

Patch Information

Check Point has released fixes for the affected Gaia OS versions (R81, R81.10, R81.20, R82) and for Multi-Domain Management and Quantum Security Management deployments. Consult sk183101 for the specific hotfix package and installation instructions for each version.

Workarounds

Ensure Security Gateways maintain a valid CRL cache so VPN and SIC operations continue if cpca is briefly unavailable.
Limit exposure of the management server to the public network using firewall policy and network segmentation.
Implement process supervision to automatically restart cpca upon unexpected exit while the patch is being scheduled.

bash

# Verify cpca process status on Check Point management server
cpwd_admin list | grep CPCA

# Check for recent cpca core dumps
ls -lt /var/log/dump/usermode/ | grep cpca

# Review cpca log for abnormal exits
tail -n 200 $FWDIR/log/cpca.elg